<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.malfind.MalwareEPROCESS : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.m.MalwareEPROCESS(<a href="volatility.plugins.overlays.windows.windows._EPROCESS.html">windows._EPROCESS</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.malfind.html">malfind</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.malfind.MalwareEPROCESS">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>Extension of the default EPROCESS with some helpers<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id215">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#IsWow64">IsWow64</a></td>
    <td><span>Returns True if this is a wow64 process</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#SessionId">SessionId</a></td>
    <td><span>Returns the Session ID of the process</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#get_vads">get_vads</a></td>
    <td><span>Generator for MMVADs that match specific metadata.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#search_process_memory">search_process_memory</a></td>
    <td><span>Search memory for a simple byte string.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#environment_variables">environment_variables</a></td>
    <td><span>Generator for environment variables.</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#_injection_filter">_injection_filter</a></td>
    <td><span>This is a callback that's executed by get_vads() when searching for injected code / hidden DLLs.</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.malfind.MalwareEPROCESS.html#_mapped_file_filter">_mapped_file_filter</a></td>
    <td><span>This is a callback that's executed by get_vads() when searching for memory-mapped files.</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.overlays.windows.windows._EPROCESS.html">_EPROCESS</a>:
        </p>
        <table class="children sortable" id="id216">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#Peb">Peb</a></td>
    <td><span>Returns a _PEB object which is using the process address space.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#get_process_address_space">get_process_address_space</a></td>
    <td><span>Gets a process address space for a task given in _EPROCESS</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#get_init_modules">get_init_modules</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#get_mem_modules">get_mem_modules</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#get_load_modules">get_load_modules</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#get_token">get_token</a></td>
    <td><span>Return the process's TOKEN object if its valid</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.overlays.windows.windows._EPROCESS.html#_get_modules">_get_modules</a></td>
    <td><span>Generator for DLLs in one of the 3 PEB lists</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.CType.html">CType</a> (via <a href="volatility.plugins.overlays.windows.windows._EPROCESS.html">_EPROCESS</a>):
        </p>
        <table class="children sortable" id="id217">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__init__">__init__</a></td>
    <td><span>This must be instantiated with a dict of members. The keys are the offsets, the values are Curried Object classes that will be instantiated when accessed.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#size">size</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__repr__">__repr__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#d">d</a></td>
    <td><span>Display diagnostic information</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#v">v</a></td>
    <td><span>When a struct is evaluated we just return our offset.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#m">m</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__getattr__">__getattr__</a></td>
    <td><span>This is only useful for proper methods (not ones that start with __ )</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.CType.html#__setattr__">__setattr__</a></td>
    <td><span>Change underlying members</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.obj.BaseObject.html">BaseObject</a> (via <a href="volatility.plugins.overlays.windows.windows._EPROCESS.html">_EPROCESS</a>, <a href="volatility.obj.CType.html">CType</a>):
        </p>
        <table class="children sortable" id="id218">
  
  
<tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_type">obj_type</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_vm">obj_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_offset">obj_offset</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_parent">obj_parent</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_name">obj_name</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#obj_native_vm">obj_native_vm</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#set_native_vm">set_native_vm</a></td>
    <td><span>Sets the native_vm</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#rebase">rebase</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#proxied">proxied</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#newattr">newattr</a></td>
    <td><span>Sets a new attribute after the object has been created</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#write">write</a></td>
    <td><span>Function for writing the object back to disk</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__nonzero__">__nonzero__</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__eq__">__eq__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__ne__">__ne__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__hash__">__hash__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#is_valid">is_valid</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference">dereference</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#dereference_as">dereference_as</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#cast">cast</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__format__">__format__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__str__">__str__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__getstate__">__getstate__</a></td>
    <td><span>This controls how we pickle and unpickle the objects</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.obj.BaseObject.html#__setstate__">__setstate__</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS.IsWow64">
    
  </a>
  <a name="IsWow64">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    IsWow64(self):
    
  </div>
  <div class="functionBody">
    
    <div>Returns True if this is a wow64 process<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS.SessionId">
    
  </a>
  <a name="SessionId">
    
  </a>
  <div class="functionHeader">
    @property<br />
    def
    SessionId(self):
    
  </div>
  <div class="functionBody">
    
    <div>Returns the Session ID of the process<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS.get_vads">
    
  </a>
  <a name="get_vads">
    
  </a>
  <div class="functionHeader">
    
    def
    get_vads(self, vad_filter=None):
    
  </div>
  <div class="functionBody">
    
    <div>Generator for MMVADs that match specific
metadata.</p>
<p>&#64;param vad_filter: a callable that is passed the
current MMVAD and applies tests to the MMVAD struct
members or nested struct members.</p>
<p>&#64;yields a tuple (mmvad, address_space). Where mmvad is
the MMVAD object in kernel AS and address_space
is the process address space.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS.search_process_memory">
    
  </a>
  <a name="search_process_memory">
    
  </a>
  <div class="functionHeader">
    
    def
    search_process_memory(self, s):
    
  </div>
  <div class="functionBody">
    
    <div>Search memory for a simple byte string.</p>
<p>&#64;param s: the string to search for.</p>
<p>&#64;returns every occurrance of the string
in process memory (as absolute address).<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS._injection_filter">
    
  </a>
  <a name="_injection_filter">
    
  </a>
  <div class="functionHeader">
    
    def
    _injection_filter(self, vad):
    
  </div>
  <div class="functionBody">
    
    <div>This is a callback that's executed by get_vads()
when searching for injected code / hidden DLLs.</p>
<p>This looks for private allocations that are committed,
memory-resident, non-empty (not all zeros) and with an
original protection that includes write and execute.</p>
<p>It is important to note that protections are applied at
the allocation granularity (page level). Thus the original
protection might not be the current protection, and it
also might not apply to all pages in the VAD range.</p>
<p>&#64;param vad: an MMVAD object.</p>
<p>&#64;returns: True if the MMVAD looks like it might
contain injected code.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS._mapped_file_filter">
    
  </a>
  <a name="_mapped_file_filter">
    
  </a>
  <div class="functionHeader">
    
    def
    _mapped_file_filter(self, vad):
    
  </div>
  <div class="functionBody">
    
    <div>This is a callback that's executed by get_vads()
when searching for memory-mapped files.</p>
<p>&#64;param vad: an MMVAD object.</p>
<p>&#64;returns: True if the MMVAD looks like it might
contain a mapped file.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.malfind.MalwareEPROCESS.environment_variables">
    
  </a>
  <a name="environment_variables">
    
  </a>
  <div class="functionHeader">
    
    def
    environment_variables(self):
    
  </div>
  <div class="functionBody">
    
    <div>Generator for environment variables.</p>
<p>The PEB points to our env block - a series of null-terminated
unicode strings. Each string cannot be more than 0x7FFF chars.
End of the list is a quad-null.<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>